16.1 Text Mining

Text mining holds considerable promise for applied public safety and security mining and analysis. The ability to tap directly into and use unstructured narrative data will be game changing in many ways. Most analysts understand the value represented in those resources; however, the work required to manually extract that information and recode it is extremely time consuming and generally not as accurate as automated methods. In my own experience, I was able to quickly search a large number of robbery reports in an effort to identify a series defined by a unique MO. In that first foray into text mining, the tool identified several incidents that I knew about and a few more that were new to me. After this experience, I was a true believer in the power and capacity embodied in text mining tools.

In the very near future, I envision the development of public safety and security-specific glossaries that will incorporate the unique lexicon and terms associated with law enforcement and intelligence analysis. Like the specialized glossaries developed for other professions that represent their own unique language and terms (e.g., medicine), these enhanced capabilities will allow analysts to build on the work of others, creating a critical mass of shared knowledge that will allow all of us to do our jobs better. Also, as outlined in the Introduction and illustrated in Figure 16-1, I envision the development of tools that will link voice recognition and translation software directly to these text mining tools and provide “just-in-time” analytical support to operationans when and where they need it, without the need for cumbersome and time-consuming data collection and entry processes. Integrated tools can be used to integrate and analyze data from a variety of geographically distinct collection locations, further enhancing the depth of knowledge afforded to the operational personnel serving on the front lines. Ultimately, tools like these not only promise to enhance field-based interviewing but also will provide a level of situational awareness not currently available. They will increase the efficacy of the operational personnel while keeping them safer.

Figure 16-1 This model conceptually illustrates how information and analysis can inform and feed the operational process.

16.2 Fusion Centers

The concept of regional data fusion and the emergence of regional fusion centers supporting this task has been mentioned. While the idea of even more data to analyze secretly thrills most analysts, creation of these fusion centers represents only the first step in the process. Currently, many of these centers focus almost exclusively on the collection aspect of the process and support only limited analytical capacity. The analytical functions offered by these centers frequently include only the capacity to search the data repository and some ability to perform descriptive statistics. The next step in the process should involve moving away from counting crime and toward characterizing and modeling incidents in an effort to anticipate, predict, prevent, and deter.

As we link these regional fusion centers and include options for predictive analysis, we set the stage for the creation of analytical webs that become almost self-perpetuating in their identification of associations and relationships. As illustrated in Figure 16-2, an array of linked collection nodes that are supported by a common analytical fusion center starts to resemble a neural network model. Enhancing the connectivity by integrating predictive analytics would bring this model even closer to a true neural network. The knowledge discovery and predictive analysis that could be supported by a model like this example could be game changing in its ability to support information-based decisions in the applied setting.

Figure 16-2 Conceptual illustration of an information web that includes an analytical core or fusion center.

16.3 “Functional” Interoperability

The concept of interoperability has received considerable attention recently, yet the true success of this approach lies in the ability to achieve “functional interoperability.” Functional interoperability involves more than just information access and can be achieved only when the shared resources are used effectively to support joint decisions and complementary responses. By using data mining tools and emphasizing “operationally actionable” output that focuses on the time, location, and nature of potentially threatening behavior, the relevant public safety resources can be deployed efficiently in support of public safety and homeland security objectives.

16.4 “Virtual” Warehouses

Traditional data warehouses can be extremely costly and generally lack the speed and agility required by public safety and security analysis. Tools like Google and the FAST Enterprise Search Platform represent a new approach to information access and management. By indexing large data sets, including the World Wide Web, these tools give analysts the ability to create “virtual” warehouses that embody the speed and flexibility generally not available with traditional data warehouses. These indices can be updated and refreshed, noting changes in the information available as they occur. The accessibility and ease with which these tools can be used are reflected in their ubiquitous use and the fact the “Google” has gained status as a verb (e.g., “Why don’t you Google this and see what comes up?” or “I Googled you last night and came up with a number of hits.”).

These tools also give analysts an opportunity to tap into open-source material more effectively. I continue to be absolutely amazed at the amount of information available over the Internet. While chat rooms and blogs have represented a valuable source of information for several years, the sheer magnitude of the amount of data freely available and accessible over the World Wide Web is staggering, far beyond what the human mind can monitor and track. In addition, propaganda highlighting terrorist tactics and strategy has been showing up on the Internet, including the Al Qaeda handbook and streaming video demonstrating preoperational surveillance, target selection, and attack planning.¹ This information has tremendous value if identified, monitored, and studied, a task that these indexing tools has made more manageable.

16.5 Domain-Specific Tools

The emergence of tools designed specifically for public safety and security analysis is an exciting trend that I hope continues. While data mining and predictive analytics can be very intuitive, matching an analyst’s style of investigation and query, many of the existing tools are somewhat limited in their ability to be used directly in the applied setting. To be sure, almost every example included in this book was generated using standard, off-the-shelf versions of existing data mining software tools, which supports the fact that these products can be used in the applied setting. The development of applications designed specifically for public safety and security analysis, however, makes them even more accessible. Similarly, advances in the visual depiction of complex analytical output are the focus of considerable research effort. Analytical output that builds on the end user’s tacit knowledge and that can be transferred directly to the applied setting in support of information-based decisions and operations is an exciting area that is sure to grow considerably in the very near future.

16.6 Closing Thoughts

If we have learned anything since 9/11, it is that we need to do more than collect data; we need to effectively analyze it in a way that facilitates the direct translation of the analytical output into information-based decisions and operational support.

Most of the data used in crime and intelligence analysis was gathered for some other purpose: billing, case management, and so on. In some situations, however, data sets are generated for the purpose of crime and intelligence analysis. Whenever possible, it is best to use data management systems that were designed for that purpose. There are a variety of database and data management tools commercially available. But be extremely cautious of analytical tools that also have an integrated database function that does not demonstrate clearly the future accessibility of the stored information.

One of the most exciting things in the public safety sector is the increased availability of technology resources for data management and analysis. This rapid increase in technology certainly is related to increased need, as well as to increased demand for new products. Unfortunately, some of the increase in the availability of products also might be related to the lucrative nature of public safety technology. Particularly after 9/11, the availability of funding for homeland security-related technology has increased astronomically. Unfortunately, not all of the products made available have the necessary internal capacity and flexibility to make them part of a long-term plan for meaningful, integrated technology enhancements.

The worst-case scenario associated with this proliferation of new technology is that information can be entered into some type of database or program and, when a need arises in the future, it becomes readily apparent that retrieval of the data is extremely difficult, if not impossible. In other words, the data has been put in an information “lockbox” and is inaccessible to other types of information processing or analytical tools. Unfortunately, this situation seems to arise with increasing frequency as agencies attempt to automate without consideration of future needs.

New programs and techniques are being developed daily, and most agencies have limited funds, particularly for purchasing new technology. Multifunction software can be appealing, particularly those programs that store as well as analyze data. While attractive to some, the use of a “one-stop shopping” approach to data storage and analysis can have a disastrous effect if it is difficult or impossible to extract data. Rather than saving money, these packages often end up costing more in the long run. Double entry of data is not only extremely unpleasant but also costly in terms of duplicative personnel efforts. Perhaps more importantly, though, it significantly increases the possibility of errors. When considering these options, therefore, one question that should always be asked is, “Can I get the data out of here if another software program comes along that I would like to use?” It is critical to ensure that data and information are maintained in a common, readily accessible format, preferably something that was designed to store data and permit access. Whether a simple spreadsheet program or something more elaborate like a data warehouse, the important consideration is whether it will allow the analyst to access the information and exploit new analytical packages as they become available.

If we have learned little else in the past few years, one thing that has become abundantly clear is that there probably is no Rosetta Stone of crime and intelligence information. The sharp organizations on the cutting edge of analytics have acquired and maintain the ability to integrate different data resources and exploit new technologies as soon as they become available. Similarly, one consistent theme throughout this text is the importance of maintaining flexibility in the analytical process. It is unclear what challenges will be present tomorrow, or what new analytical tools are just over the horizon. The paradigm shift associated with incorporating business tools and analysis in crime and intelligence analysis has been absolutely amazing, and analysts are an incredibly resourceful group out of necessity. As a result, it is exciting to consider what will be incorporated into our world tomorrow. Do not get left behind. Ensure that your data are accessible and available as these new technologies come on line.